Extracted

Extracted

Extracted

Extracted

• • Target

    4d893cc9cad144508ab60d967de1af6ff37f2049c7adc73b756812444c0f151f

  • Size

    819KB

  • MD5

    d43179e5cb6353e4de7038bdc47b01ac

  • SHA1

    2af16fcb37dd760d46c43c895e66e08eaf3ce4e7

  • SHA256

    4d893cc9cad144508ab60d967de1af6ff37f2049c7adc73b756812444c0f151f

  • SHA512

    e6fc5976a203dfc4ea7436721f5eb9a580c212f790e4d3acf90f4ae48525535816aa4e764ff9488408d649f7195e0465321bb063297050d88087549d33ad08fe

  • SSDEEP

    12288:DBdlwHRn+WlYV+96qE9SR6rGiIZgUhtUJ++n0UCbMFKb7dnOu84S6Kc90Y7Y:DBkVdlYAQC6rCJhq0UQMFKb7dOu84xZq

  Score

  10^/10

  asyncrat014agostoagosto 14discoveryexecutionratnjratnyan catpersistencetrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2